An account identification method based on a behavior sequence tree and related equipment

Abstract

A kind of account identification method, device, electronic equipment and storage medium based on behavior sequence tree, the method includes the steps of: based on the preset behavior of to-be-identified account in preset time period constructs behavior sequence;According to the behavior sequence, the behavior sequence tree of the to-be-identified account is constructed;Based on the behavior sequence tree, the user behavior sequence vector expression of the to-be-identified account is generated;According to the user behavior sequence vector expression, the account numerical expression of the to-be-identified account is generated;Based on historical positive and negative samples, the account classifier of the to-be-identified account is constructed;According to the account classifier and the account numerical expression, the classification result of the to-be-identified account is identified.This application converts the behavior sequence of to-be-identified account into behavior sequence tree, uses the characteristics of tree to dig the connection between behavior sequence, and constructs classification problem to identify the abnormal degree of path, can improve the accuracy of identification, and it is convenient to identify online.

Description

Technical Field

[0001] This invention belongs to the field of big data risk control technology, specifically involving an account recognition method and related equipment based on behavioral sequence trees. Background Technology

[0002] There are some black market accounts on live streaming platforms that engage in activities such as boosting views or exploiting loopholes. These accounts are mostly operated using batch scripts and exhibit some abnormal behavior patterns.

[0003] The common method for identifying abnormal account behavior paths is to count the number of users with the same path. If an unusually large number of users share a particular path, then that path is considered abnormal. This method is simple to implement, but it is prone to false positives. Some paths are used by both normal and abnormal users, and it is difficult to count the number of users on each path in a real-time online application. Summary of the Invention

[0004] In view of the above problems, the present invention provides an account recognition method and related equipment based on behavior sequence tree to overcome the above problems or at least partially solve the above problems.

[0005] To address the aforementioned technical problems, this invention provides an account identification method based on behavior sequence trees, the method comprising the following steps:

[0006] Construct a behavior sequence based on the preset behaviors of the account to be identified within a preset time period;

[0007] Construct a behavior sequence tree for the account to be identified based on the behavior sequence;

[0008] Generate a user behavior sequence vector expression for the account to be identified based on the behavior sequence tree;

[0009] Generate the account numerical expression of the account to be identified based on the user behavior sequence vector expression;

[0010] An account classifier is constructed based on historical positive and negative samples for the account to be identified.

[0011] The classification result of the account to be identified is determined based on the account classifier and the account numerical expression.

[0012] Preferably, the step of constructing a behavior sequence based on preset behaviors of the account to be identified within a preset time period includes the following steps:

[0013] Set preset requirements and select the preset time period;

[0014] Obtain all preset behaviors of the account to be identified that meet the preset requirements within the preset time period;

[0015] Obtain the timestamps of all the preset behaviors;

[0016] All the preset behaviors are sequentially concatenated according to all the timestamps to obtain the behavior sequence.

[0017] Preferably, constructing the behavior sequence tree of the account to be identified based on the behavior sequence includes the following steps:

[0018] Pre-define an empty tree and initialize it to obtain an initialized tree;

[0019] The behavior name of each behavior sequence is used as the node name of the corresponding node on the initialization tree in chronological order.

[0020] Determine whether the behavior name of each behavior sequence has appeared before;

[0021] If so, obtain the node name of the corresponding node as the node with the largest node address in the behavior name;

[0022] If not, add the node address, parent node address, and node name of the corresponding node to the initialization tree.

[0023] Preferably, the formula for the user behavior sequence vector expression is:

[0024] B = {b1, b2, ..., b} s},

[0025]

[0026] Among them, D p It is the set of node pairs sampled from the behavior sequence tree for the same account, where a and c are any distinct nodes in the set, and v c and v a D represents the vectors represented by nodes a and c; s It is a sample set of different accounts that have similar behaviors, D n It is a sample set of dissimilar users.

[0027] Preferably, the formula for the account numerical expression is:

[0028]

[0029]

[0030] z j =tanh(i j ),

[0031] Where tanh(·) is the hyperbolic tangent function, its form is αj These are the weight coefficients of the account vector after pooling; h is the numerical representation of the account; i j It is the j-th dimension vector after pooling, and m is the dimension of the vector.

[0032] Preferably, constructing the account classifier for the account to be identified based on historical positive and negative samples includes the following steps:

[0033] Define the optimization function for the account classifier;

[0034] Obtain the historical sample set;

[0035] Malicious accounts identified based on user path anomaly rules are selected from the historical sample set as the historical positive samples;

[0036] From the remaining samples in the historical sample set, select accounts that have not been identified as risky accounts by the preset risk control strategy as the historical negative samples;

[0037] The parameters of the optimization function are solved based on the historical positive samples and the historical negative samples;

[0038] The formula for the optimization function is as follows:

[0039]

[0040] p = sigmoid(W ρ h+b ρ ),

[0041] Among them, W ρ and b ρ These are the parameters that need to be solved for, h is the numerical representation of the account, and sigmoid is the S-shaped function. y is the label of the account sample, y=1 is a positive sample, i.e. a black market account; y=0 is a negative sample, i.e. a normal account; D is the sample set.

[0042] Preferably, the step of identifying the classification result of the account to be identified based on the account classifier and the account numerical expression includes the following steps:

[0043] Obtain the account classifier and the account numerical expression;

[0044] Substitute the account numerical expression into the account classifier to obtain the probability value of the black market account of the account to be identified;

[0045] Determine whether the probability value of the black market account is greater than a preset black market account threshold;

[0046] If so, determine that the account to be identified is a black market account;

[0047] If not, the account to be identified is determined to be a normal account.

[0048] The present invention also provides an account recognition device based on behavior sequence tree, the device comprising:

[0049] The behavior sequence construction module is used to construct a behavior sequence based on the preset behaviors of the account to be identified within a preset time period.

[0050] A behavior sequence tree construction module is used to construct a behavior sequence tree for the account to be identified based on the behavior sequence.

[0051] The user behavior sequence vector expression generation module is used to generate a user behavior sequence vector expression for the account to be identified based on the behavior sequence tree.

[0052] The account numerical expression generation module is used to generate the account numerical expression of the account to be identified based on the user behavior sequence vector expression.

[0053] An account classifier construction module is used to construct an account classifier for the account to be identified based on historical positive and negative samples.

[0054] The classification result recognition module is used to identify the classification result of the account to be identified based on the account classifier and the account numerical expression.

[0055] The present invention also provides an electronic device, the electronic device comprising:

[0056] At least one processor; and,

[0057] A memory communicatively connected to the at least one processor; wherein,

[0058] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the account identification method based on behavior sequence tree as described above.

[0059] The present invention also provides a storage medium storing a computer program that, when executed by a processor, can implement the account recognition method based on behavior sequence tree as described above.

[0060] One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages:

[0061] This application provides an account recognition method, device, electronic device, and storage medium based on behavior sequence trees. It converts the behavior sequence of the account to be identified into a behavior sequence tree structure for sequence representation, utilizes the characteristics of trees to mine the relationships between behavior sequences, and constructs a classification problem to identify the degree of abnormality of the path, which can improve the accuracy of recognition and facilitate online recognition. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a flowchart illustrating an account recognition method based on a behavior sequence tree provided in an embodiment of the present invention;

[0064] Figure 2 This is a schematic diagram of a behavior sequence tree obtained by an account recognition method based on a behavior sequence tree provided in an embodiment of the present invention;

[0065] Figure 3 This is a schematic diagram of an account recognition device based on a behavior sequence tree provided in an embodiment of the present invention;

[0066] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of the present invention;

[0067] Figure 5 This is a schematic diagram of a storage medium provided in an embodiment of the present invention. Detailed Implementation

[0068] The present invention will be described in detail below with reference to specific embodiments and examples, thereby making the advantages and various effects of the present invention more clearly apparent. Those skilled in the art should understand that these specific embodiments and examples are for illustrative purposes only and are not intended to limit the present invention.

[0069] Throughout this specification, unless otherwise specified, the terminology used herein should be understood as having the meaning commonly used in the art. Therefore, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. In the event of any conflict, this specification shall prevail.

[0070] Unless otherwise specified, all raw materials, reagents, instruments and equipment used in this invention can be purchased from the market or prepared by existing methods.

[0071] like Figure 1 In this application embodiment, the present invention provides an account identification method based on behavior sequence tree, the method comprising the following steps:

[0072] S1: Construct a behavior sequence based on the preset behaviors of the account to be identified within a preset time period;

[0073] In this embodiment of the application, step S1, which involves constructing a behavior sequence based on the preset behavior of the account to be identified within a preset time period, includes the following steps:

[0074] Set preset requirements and select the preset time period;

[0075] Obtain all preset behaviors of the account to be identified that meet the preset requirements within the preset time period;

[0076] Obtain the timestamps of all the preset behaviors;

[0077] All the preset behaviors are sequentially concatenated according to all the timestamps to obtain the behavior sequence.

[0078] In this embodiment, when constructing a behavior sequence based on preset behaviors of the account to be identified within a preset time period, preset requirements are first set and the preset time period is selected. Specifically, the selected time period cannot be too long or too short; too short a period will fail to highlight abnormal characteristics, while too long a period will be too complex to calculate. Generally, 7 days is selected. Then, all preset behaviors of the account to be identified that meet the preset requirements within the preset time period are obtained. Specifically, the preset requirements can be set as needed, such as importance, operation frequency, user preference, etc. Correspondingly, preset behaviors include watching, sending bullet comments, gifting fish balls, gifting fish fins, etc. Then, the timestamps of all preset behaviors are obtained, and all preset behaviors are sequentially concatenated according to all timestamps to obtain the behavior sequence.

[0079] S2: Construct a behavior sequence tree for the account to be identified based on the behavior sequence;

[0080] In this embodiment of the application, step S2, which involves constructing the behavior sequence tree of the account to be identified based on the behavior sequence, includes the following steps:

[0081] Pre-define an empty tree and initialize it to obtain an initialized tree;

[0082] The behavior name of each behavior sequence is used as the node name of the corresponding node on the initialization tree in chronological order.

[0083] Determine whether the behavior name of each behavior sequence has appeared before;

[0084] If so, obtain the node name of the corresponding node as the node with the largest node address in the behavior name;

[0085] If not, add the node address, parent node address, and node name of the corresponding node to the initialization tree.

[0086] In this embodiment, when constructing the behavior sequence tree of the account to be identified based on the behavior sequence, an empty tree is first preset and initialized to obtain an initialization tree. The node address and parent node address of the initialization tree are 0. Then, the behavior name of each behavior sequence is used as the node name of the corresponding node on the initialization tree in chronological order, and it is determined whether the behavior name of each behavior sequence has appeared before. If it has, the node name of the corresponding node is obtained as the node with the largest node address among the behavior names. If it has not, the node address, parent node address, and node name of the corresponding node are added to the initialization tree.

[0087] The following specific examples illustrate the working process of this step.

[0088] Assuming the user's behavior sequence is: A->B->C->D->E->D->A->F->D, during the construction of the behavior sequence tree for the account to be identified, the behavior names in the sequence A->B->C->D->E are all new. Therefore, the node address, parent node address, and node name of the corresponding node are added to the initialization tree to construct a new node. Since the second D appears again, the current maximum node address with the name D is found to be 3, and the subtree set of this node is (4,E,3), and its parent node is in this set, so it is not added again. The last D is not in the maximum subtree set of the name D, so a new node is added, and the corresponding node address, parent node address, and node name are added to the initialization tree. (The last part is incomplete and likely refers to a separate process.) Figure 2 The diagram shown.

[0089] In this embodiment, the advantage of transforming a behavior sequence into a behavior sequence tree is that a behavior sequence represents a sequential relationship, while a tree structure can depict more complex connections. In black market account identification scenarios, black market accounts employ various methods to disguise themselves. For example, after registering, a black market account may not immediately engage in fraudulent activity but instead mimics the behavior of legitimate accounts, thus introducing noise into the sequence data. A tree structure can avoid such noise, and by identifying the fraudulent activity subtree, the modus operandi of black market accounts can be discovered.

[0090] S3: Generate a user behavior sequence vector expression for the account to be identified based on the behavior sequence tree;

[0091] In this embodiment of the application, the formula for the user behavior sequence vector expression in step S3 is:

[0092] B = {b1, b2, ..., b} s},

[0093]

[0094] Among them, D p It is the set of node pairs sampled from the behavior sequence tree for the same account, where a and c are any distinct nodes in the set, and v c and v a D represents the vectors represented by nodes a and c; s It is a sample set of different accounts that have similar behaviors, D n It is a sample set of dissimilar users.

[0095] In this embodiment of the application, an optimization function is first constructed:

[0096]

[0097] This optimization function consists of three parts. The account's behavior represents the actions performed using that account, and their vectors should be similar. Therefore, in the sample set, D... p These are pairs of nodes on the same account's behavior sequence tree; if two accounts have similar behavior sequence trees, then the vectors of the nodes on the two account sequence trees are also similar, therefore in the sample set D... s The sample set D represents the node pairs where different accounts share the same name, and both nodes have identical subtree structures with a depth of at least 3. Other node pairs not belonging to either of these two sets do not have a clear correlation, therefore their vectors should be dissimilar. n The inner product of vectors directly reflects their relationships; therefore, the inner product of similar behavior node vectors will be smaller, and thus, the larger the overall optimization function, the better. Based on this principle, the optimal representation of the account behavior node vectors is when the optimization function is maximized. Using the above method, each leaf node can be represented by a vector: B = {b1, b2, ..., b...} s}

[0098] In the above optimization function formula, the first two terms consider similar accounts of an account. Similar accounts are either on the same account sequence tree or the sequence trees have similar structures. The vector dot product of an account and its similar accounts is close, so the first two terms of the formula should be as large as possible. The third term of the optimization function formula considers dissimilar accounts of an account. The vector dot product of an account and its dissimilar accounts is not close, so the third term of the formula should be as small as possible. In order to make the entire optimization function formula have the same goal, the sign in front of the third term of the formula should be set to negative.

[0099] The above optimization function formula considers both samples similar to the account and samples dissimilar to the account, thus ensuring that the account vectors obtained from training are more accurate and that the distance between accounts in the vector space is scientifically sound.

[0100] S4: Generate the account numerical expression of the account to be identified based on the user behavior sequence vector expression;

[0101] In this embodiment of the application, the formula for the account numerical expression in step S4 is:

[0102]

[0103]

[0104] z j =tanh(i j ),

[0105] Where tanh(·) is the hyperbolic tangent function, its form is α j These are the weight coefficients of the account vector after pooling; h is the numerical representation of the account; i j It is the j-th dimension vector after pooling, and m is the dimension of the vector.

[0106] In this embodiment, pooling is first performed on B to obtain I, and the formula for I is:

[0107] I = {i1, i2, ..., i} m}

[0108] Pooling is an operation that averages consecutive elements in B to obtain elements in I.

[0109]

[0110] Where t is a constant representing the pooling step size. t can be chosen as needed; specifically, a step size that is too large will cause excessive information loss, while a step size that is too small will fail to achieve the purpose of pooling. s+k-1 It is the value of the account vector in dimension s+k-1, is This represents the value of the s-th dimension of the vector after account pooling. The purpose of pooling here is to reduce the dimensionality of features, simplify computation, and improve the generalization ability of the vector.

[0111] To further aggregate this vector, perform the following operation on I:

[0112] z j =tanh(i j ),

[0113]

[0114]

[0115] Where: tanh(·) is the hyperbolic tangent function, its form is α j is the weight coefficient of the account vector after pooling; h is the numerical representation of the account. j It is the j-th dimension vector after pooling, and m is the dimension of the vector.

[0116] The principle behind the above formula is: by applying a non-linear transformation to the vector elements using the tanh function, it gains stronger generalization ability. The weight of each vector element is calculated, and this normalization method ensures that the sum of the weights is 1. The final account value can be obtained by weighted summation.

[0117] The advantage of the above formula is that if the pooled vectors are not processed, they cannot be directly compared, and the vector values ​​have no range limit, making subsequent comparisons inconvenient. Therefore, the tanh function is used to process each dimension of the vector, making the values ​​between -1 and 1. To ensure that account information is ultimately represented by a single value, the result of the above transformation is exponentially transformed. This allows us to consider the absolute value of the transformation result; the larger the absolute value, the farther the dimension is from the center, representing more information, and thus giving it a greater weight. For the behavioral sequence information of each account, a single numerical value can be used to represent it. This value for all accounts lies in the same space, ensuring their correlation.

[0118] S5: Construct an account classifier for the account to be identified based on historical positive and negative samples;

[0119] In this embodiment of the application, step S5, which involves constructing an account classifier based on historical positive and negative samples, includes the following steps:

[0120] Define the optimization function for the account classifier;

[0121] Obtain the historical sample set;

[0122] Malicious accounts identified based on user path anomaly rules are selected from the historical sample set as the historical positive samples;

[0123] From the remaining samples in the historical sample set, select accounts that have not been identified as risky accounts by the preset risk control strategy as the historical negative samples;

[0124] The parameters of the optimization function are solved based on the historical positive samples and the historical negative samples;

[0125] The formula for the optimization function is as follows:

[0126]

[0127] p = sigmoid(W ρ h+b ρ ),

[0128] Among them, W ρ and b ρ These are the parameters that need to be solved for, h is the numerical representation of the account, and sigmoid is the S-shaped function. y is the label of the account sample, y=1 is a positive sample, i.e. a black market account; y=0 is a negative sample, i.e. a normal account; D is the sample set.

[0129] In this embodiment of the application, when constructing an account classifier for the account to be identified based on historical positive and negative samples, the optimization function of the account classifier is first defined, then a historical sample set is obtained, and malicious accounts identified based on user path anomaly rules are selected from the historical sample set as historical positive samples. At the same time, accounts that are not identified as risky accounts by the preset risk control strategy are selected from the remaining samples in the historical sample set as historical negative samples. The parameters of the optimization function are then solved based on the historical positive samples and the historical negative samples.

[0130] The formula for the optimization function is:

[0131]

[0132] Where: p = sigmoid(W ρ h+b ρ W is the label of the account sample, where y = 1 is a positive sample (i.e., a black market account) and y = 0 is a negative sample (i.e., a normal account). D is the sample set. In this embodiment, W can be solved using techniques such as gradient descent or Newton's method. ρ and b ρ When L is minimized, the corresponding parameters are the parameters of the desired optimization function.

[0133] The principle behind the above optimization function definition is that whether an account is a black market account follows a binomial distribution, meaning the probability of an account being a black market account is p, and the probability of it being a legitimate account is 1-p. Therefore, a maximum likelihood estimate can be constructed: The goal of maximum likelihood estimation is to maximize the above expression. Therefore, we can differentiate the above maximum likelihood estimation to obtain:

[0134]

[0135] Let L = -lnF, then solving for the maximum value of F is transformed into finding the minimum value of L. The advantage of doing this is that it makes it easier to solve using the gradient descent method.

[0136] S6: Identify the classification result of the account to be identified based on the account classifier and the account numerical expression.

[0137] In this embodiment of the application, step S6, which identifies the classification result of the account to be identified based on the account classifier and the account numerical expression, includes the following steps:

[0138] Obtain the account classifier and the account numerical expression;

[0139] Substitute the account numerical expression into the account classifier to obtain the probability value of the black market account of the account to be identified;

[0140] Determine whether the probability value of the black market account is greater than a preset black market account threshold;

[0141] If so, determine that the account to be identified is a black market account;

[0142] If not, the account to be identified is determined to be a normal account.

[0143] In this embodiment of the application, when identifying the classification result of the account to be identified based on the account classifier and the account numerical expression, the account classifier and the account numerical expression are first obtained. The account numerical expression is: Then, the account numerical expression is substituted into the account classifier to obtain the probability value of the black market account of the account to be identified. The expression for the probability value of the black market account is: p = sigmoid(W ρ h+b ρThe process then determines whether the probability value of the black market account is greater than a preset black market account threshold. If the calculated probability value is higher than the threshold, the account is identified as a black market account, and behavioral restrictions are imposed on it. If the calculated probability value is lower than the threshold, the account is identified as a legitimate account. The threshold for black market accounts is influenced by the business scenario's requirements for coverage and accuracy. If high coverage or low accuracy is required, the threshold should be set smaller, and vice versa.

[0144] The following example illustrates this: Suppose the vector obtained by solving the account using the optimization function is: B = (1.3, 1.6, 1.9, -1.0). Taking a step size of 2 for pooling, we get: I = (1.45, 1.75, 0.45). Applying the tanh transformation to the above vector, we get: Therefore, it can be calculated;

[0145]

[0146] If the parameter W to be solved ρ =0.2,b ρ =0.5, so substituting this into the calculation, we can obtain the probability that the account is a blacklisted account as: Since 0.34 is less than 0.5, the account is determined not to be a spoofed account.

[0147] In this embodiment of the application, when identifying an account based on a behavior sequence tree, firstly, a behavior sequence is constructed based on the preset behaviors of the account to be identified within a preset time period. Then, a behavior sequence tree of the account to be identified is constructed based on the behavior sequence. Next, a user behavior sequence vector expression of the account to be identified is generated based on the behavior sequence tree. Then, an account numerical expression of the account to be identified is generated based on the user behavior sequence vector expression. Next, an account classifier of the account to be identified is constructed based on historical positive and negative samples. Finally, the classification result of the account to be identified is identified based on the account classifier and the account numerical expression, thereby completing the classification of the account to be identified.

[0148] This application provides an account recognition method based on behavior sequence trees, which transforms the behavior sequence of the account to be identified into a behavior sequence tree structure for sequence representation. It utilizes the characteristics of trees to mine the relationships between behavior sequences and constructs a classification problem to identify the degree of abnormality of the path, which can improve the recognition accuracy and facilitate online recognition.

[0149] like Figure 3 In this application embodiment, the present invention also provides an account recognition device based on a behavior sequence tree, the device comprising:

[0150] The behavior sequence construction module 10 is used to construct a behavior sequence based on the preset behaviors of the account to be identified within a preset time period.

[0151] The behavior sequence tree construction module 20 is used to construct a behavior sequence tree of the account to be identified based on the behavior sequence.

[0152] User behavior sequence vector expression generation module 30 is used to generate user behavior sequence vector expressions for the account to be identified based on the behavior sequence tree;

[0153] The account numerical expression generation module 40 is used to generate the account numerical expression of the account to be identified based on the user behavior sequence vector expression.

[0154] Account classifier construction module 50 is used to construct an account classifier for the account to be identified based on historical positive and negative samples;

[0155] The classification result recognition module 60 is used to recognize the classification result of the account to be identified based on the account classifier and the account numerical expression.

[0156] The account recognition device based on behavior sequence tree provided in this application can perform the account recognition method based on behavior sequence tree described above.

[0157] The following is for reference. Figure 4 This document illustrates a structural schematic of an electronic device 100 suitable for implementing embodiments of the present disclosure, which is capable of implementing the account recognition method based on behavior sequence trees as described above. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0158] like Figure 4 As shown, the electronic device 100 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 102 or a program loaded from a storage device 108 into a random access memory (RAM) 103. The RAM 103 also stores various programs and data required for the operation of the electronic device 100. The processing unit 101, ROM 102, and RAM 103 are interconnected via a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0159] Typically, the following systems can be connected to I / O interface 105: input devices 106 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 107 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 108 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1010. Communication device 1010 allows electronic device 100 to communicate wirelessly or wiredly with other devices to exchange data. Although electronic device 100 with various devices is shown in the figure, it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0160] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 1010, or installed from storage device 108, or installed from ROM 102. When the computer program is executed by processing device 101, it performs the functions defined in the methods of embodiments of this disclosure.

[0161] The following is for reference. Figure 5 The diagram illustrates a structure of a computer-readable storage medium suitable for implementing embodiments of the present disclosure, the computer-readable storage medium storing a computer program that, when executed by a processor, can implement the account recognition method based on behavior sequence tree as described above.

[0162] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution device, system, or apparatus. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution device, system, or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0163] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0164] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: acquire at least two Internet Protocol (IP) addresses; send a node evaluation request including the at least two IP addresses to a node evaluation device, wherein the node evaluation device selects an IP address from the at least two IP addresses and returns it; and receive the IP address returned by the node evaluation device; wherein the acquired IP address indicates an edge node in a content delivery network.

[0165] Alternatively, the aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: receive a node evaluation request including at least two Internet Protocol (IP) addresses; select an IP address from the at least two IP addresses; and return the selected IP address; wherein the received IP address indicates an edge node in the content delivery network.

[0166] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, procedural Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses".

[0169] It should be understood that the various parts of this disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0170] This application provides an account recognition method, device, electronic device, and storage medium based on behavior sequence trees. It converts the behavior sequence of the account to be identified into a behavior sequence tree structure for sequence representation, utilizes the characteristics of trees to mine the relationships between behavior sequences, and constructs a classification problem to identify the degree of abnormality of the path, which can improve the accuracy of recognition and facilitate online recognition.

[0171] Finally, it should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. In this application, "first" and "second" can be understood as nouns.

[0172] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0173] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An account recognition method based on behavior sequence trees, characterized in that, The method includes the following steps: Construct a behavior sequence based on the preset behaviors of the account to be identified within a preset time period; Construct a behavior sequence tree for the account to be identified based on the behavior sequence; Generate a user behavior sequence vector expression for the account to be identified based on the behavior sequence tree; Generate the account numerical expression of the account to be identified based on the user behavior sequence vector expression; An account classifier is constructed based on historical positive and negative samples for the account to be identified. The classification result of the account to be identified is determined based on the account classifier and the account numerical expression; The process of constructing a behavior sequence based on the preset behavior of the account to be identified within a preset time period includes the following steps: Set preset requirements and select the preset time period; Obtain all preset behaviors of the account to be identified that meet the preset requirements within the preset time period; Obtain the timestamps of all the preset behaviors; To obtain the behavior sequence, all the preset behaviors are sequentially concatenated according to all the timestamps. The step of constructing the behavior sequence tree of the account to be identified based on the behavior sequence includes the following steps: Pre-define an empty tree and initialize it to obtain an initialized tree; The behavior name of each behavior sequence is used as the node name of the corresponding node on the initialization tree in chronological order. Determine whether the behavior name of each behavior sequence has appeared before; If so, obtain the node name of the corresponding node as the node with the largest node address in the behavior name; If not, add the node address, parent node address, and node name of the corresponding node to the initialization tree.

2. The account recognition method based on behavior sequence tree according to claim 1, characterized in that, The step of identifying the classification result of the account to be identified based on the account classifier and the account numerical expression includes the following steps: Obtain the account classifier and the account numerical expression; Substitute the account numerical expression into the account classifier to obtain the probability value of the black market account of the account to be identified; Determine whether the probability value of the black market account is greater than a preset black market account threshold; If so, determine that the account to be identified is a black market account; If not, the account to be identified is determined to be a normal account.

3. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the account identification method based on behavior sequence tree as described in any one of claims 1-2.

4. A storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it can implement the account recognition method based on behavior sequence tree as described in any one of claims 1-2.

Images